Table of Contents for

Practical Malware Analysis

D

da command, in WinDbg, Setting Up Kernel Debugging

.data section in PE file, The PE File Headers and Sections, Examining PE Files with PEview, Using Named Constants, Viewing Structure Information, Knowing the Sources of Network Content, Detailed Analysis

hard-coded vs. ephemeral, Knowing the Sources of Network Content

overlaying onto structure, Viewing Structure Information

Python script for converting to string, Detailed Analysis

redefining in IDA Pro, Using Named Constants

size of, Examining PE Files with PEview

data buffers, instructions for manipulating, Branching

data cross-references, Code Cross-References

data encoding, Data Encoding, The Goal of Analyzing Encoding Algorithms, The Goal of Analyzing Encoding Algorithms, The Goal of Analyzing Encoding Algorithms, XOR, Identifying XOR Loops in IDA Pro, Other Simple Encoding Schemes, Identifying and Decoding Base64, Common Cryptographic Algorithms, Recognizing Strings and Imports, Using Krypto ANALyzer, Searching for High-Entropy Content, Identifying Custom Encoding, Identifying Custom Encoding, Self-Decoding, Using Instrumentation for Generic Decryption, Lab 13-1, Hard-Coded Data vs. Ephemeral Data, Detailed Analysis

cryptographic algorithms, Identifying and Decoding Base64, Common Cryptographic Algorithms, Recognizing Strings and Imports, Using Krypto ANALyzer

recognizing strings and imports, Common Cryptographic Algorithms

search for cryptographic constants, Recognizing Strings and Imports

search for high-entropy content, Using Krypto ANALyzer

custom, Searching for High-Entropy Content

decoding, Identifying Custom Encoding, Identifying Custom Encoding, Self-Decoding, Using Instrumentation for Generic Decryption

instrumentation for generic decryption, Using Instrumentation for Generic Decryption

manual programming of functions, Self-Decoding

self-decoding, Identifying Custom Encoding

goal of analyzing algorithms, The Goal of Analyzing Encoding Algorithms

identifying and leveraging steps, Hard-Coded Data vs. Ephemeral Data

labs, Lab 13-1, Detailed Analysis

solutions, Detailed Analysis

simple ciphers, The Goal of Analyzing Encoding Algorithms, The Goal of Analyzing Encoding Algorithms, XOR, Identifying XOR Loops in IDA Pro, Other Simple Encoding Schemes

Base64, Other Simple Encoding Schemes

Caesar cipher, The Goal of Analyzing Encoding Algorithms

other encoding schemes, Identifying XOR Loops in IDA Pro

XOR cipher, XOR

Data Execution Prevention (DEP), Detailed Analysis

data section in main memory, Main Memory

DataDirectory array, PE Header Vulnerabilities

db command, in WinDbg, Examining the Hook Function

dd command, in WinDbg, Setting Up Kernel Debugging, Looking at the Kernel-Mode Code, Analyzing the Functions of the Major Function Table

DDoS (distributed denial-of-service) attack, RATs, Detailed Analysis

malware to launch, Detailed Analysis

debuggers, Debugging, Debugging, Debugging, Kernel vs. User-Mode Debugging, Kernel vs. User-Mode Debugging, Single-Stepping, Stepping-Over vs. Stepping-Into, Hardware Execution Breakpoints, Exceptions, Common Exceptions, Setting Breakpoints, Windows Debugger Detection, Windows Debugger Detection, Using the Windows API, Checking NTGlobalFlag, INT Scanning, INT Scanning, INT Scanning, Using QueryPerformanceCounter and GetTickCount, Using QueryPerformanceCounter and GetTickCount, Using TLS Callbacks, Using Exceptions, Inserting INT 3, Using call/pop

(see also anti-debugging; Ollydbg; WinDbg)

exceptions, Hardware Execution Breakpoints, Exceptions

first- and second-chance, Exceptions

identifying behavior, Checking NTGlobalFlag, INT Scanning, INT Scanning, INT Scanning

INT scanning, INT Scanning

performing code checksums, INT Scanning

timing checks, INT Scanning

interference with functionality, Using QueryPerformanceCounter and GetTickCount, Using QueryPerformanceCounter and GetTickCount, Using TLS Callbacks, Using Exceptions

exceptions, Using TLS Callbacks

inserting interrupts, Using Exceptions

TLS callbacks, Using QueryPerformanceCounter and GetTickCount

just-in-time, Using call/pop

kernel vs. user mode, Debugging

Microsoft symbols, Setting Breakpoints

modifying program execution with, Common Exceptions

source-level vs. assembly-level, Debugging

using, Kernel vs. User-Mode Debugging, Kernel vs. User-Mode Debugging, Single-Stepping, Stepping-Over vs. Stepping-Into

breakpoints, Stepping-Over vs. Stepping-Into

single-stepping, Kernel vs. User-Mode Debugging

stepping-over vs. stepping-into, Single-Stepping

vulnerabilities, Inserting INT 3

Windows debugger detection, Windows Debugger Detection, Windows Debugger Detection, Using the Windows API

manually checking structures, Using the Windows API

with Windows API, Windows Debugger Detection

decoding, Identifying Custom Encoding, Identifying Custom Encoding, Self-Decoding, Using Instrumentation for Generic Decryption, Short Answers, Filename Check, Detailed Analysis

anti-debugging routine in, Detailed Analysis

instrumentation for generic decryption, Using Instrumentation for Generic Decryption

manual programming of functions, Self-Decoding

self-decoding, Identifying Custom Encoding

stack-formed strings, Short Answers

XOR-encoded strings, Filename Check

decryption, Using Instrumentation for Generic Decryption, Detailed Analysis, Modified Base64 Decoding

instrumentation for generic, Using Instrumentation for Generic Decryption

of AES, Modified Base64 Decoding

requirements for, Detailed Analysis

Deep Freeze, Tools for Malware Analysis

default view for IDA Pro, returning to, Useful Windows for Analysis

default web browser, malware determination of, Short Answers

deferred breakpoint, Setting Breakpoints, Analyzing Lab10-01.sys in WinDbg

delete operator, Creating and Destroying Objects

DeleteFile function, PyCommand to prevent execution, Scriptable Debugging

Delphi programs, compile time, Examining PE Files with PEview

DEP (Data Execution Prevention), Detailed Analysis

Dependency Walker (depends.exe), Static, Runtime, and Dynamic Linking, Using the Verify Option, Tools for Malware Analysis, Detailed Analysis

destructor, Creating and Destroying Objects

Detail filter, in procmon, Filtering in Procmon

Detours, Detours

device drivers, Drivers and Kernel Code, Looking at the Kernel-Mode Code, Loading Drivers, Tools for Malware Analysis, Viewing Lab10-01.sys in IDA Pro, Viewing Lab10-01.sys in IDA Pro, Analyzing the Executable in IDA Pro, Finding the Driver in Memory with WinDbg

analysis, Analyzing the Executable in IDA Pro

finding in kernel, Looking at the Kernel-Mode Code

finding in memory, with WinDbg, Finding the Driver in Memory with WinDbg

IDA Pro to open, Viewing Lab10-01.sys in IDA Pro

loading, Loading Drivers

tool for loading, Tools for Malware Analysis

WinDbg for viewing, Viewing Lab10-01.sys in IDA Pro

device object, Looking at the User-Space Code, Looking at the Kernel-Mode Code

obtaining handle to, Looking at the User-Space Code

viewing in kernel, Looking at the Kernel-Mode Code

DeviceIoControl function, Drivers and Kernel Code, Looking at the User-Space Code, Looking at the Kernel-Mode Code, Important Windows Functions, Detailed Analysis, Analyzing the Functions of the Major Function Table

!devobj command, in WinDbg, Looking at the Kernel-Mode Code

digital logic, Levels of Abstraction

digital signatures, The Process Explorer Display

direct injection, Launchers

disassembler, Basic Dynamic Analysis, Levels of Abstraction

(see also anti-disassembly; IDA Pro (Interactive Disassembler Professional))

Disassembler window, in OllyDbg, The OllyDbg Interface

disassembly, A Crash Course in x86 Disassembly, Enhancing Disassembly, Using fnstenv

(see also x86 disassembly)

enhancing in IDA Pro, Enhancing Disassembly

of Hello World program, Using fnstenv

distance Snort rule keyword, Taking a Deeper Look

distributed denial-of-service (DDoS) attack, RATs, Detailed Analysis

malware to launch, Detailed Analysis

div instruction, Arithmetic

divide-by-zero exception, Detailed Analysis, The QueryPerformanceCounter Function

DLL display window, in Process Explorer, The Process Explorer Display

DLL injection, Trojanized System Binaries, Identifying Custom Encoding, Detailed Analysis, Detailed Analysis, Detailed Analysis

DLL load-order hijacking, Trojanized System Binaries

DllCanUnloadNow function, CLSIDs, IIDs, and the Use of COM Objects, Important Windows Functions

DllEntryPoint function, Detailed Analysis

DllGetClassObject function, CLSIDs, IIDs, and the Use of COM Objects, Important Windows Functions

DllInstall function, CLSIDs, IIDs, and the Use of COM Objects, Important Windows Functions

DllMain function, Running Malware, DLLs, Launchers, Analyzing Without Fully Unpacking, Detailed Analysis, Detailed Analysis

determining number of functions called by, Detailed Analysis

DllRegisterServer function, CLSIDs, IIDs, and the Use of COM Objects, Important Windows Functions

DLLs, Finding Strings (see dynamic link libraries (DLLs))

DllUnregisterServer function, CLSIDs, IIDs, and the Use of COM Objects, Important Windows Functions

DLL_PROCESS_ATTACH, Detailed Analysis

DNS (Domain Name System), Using Your Malware Analysis Machine, Hiding in Plain Sight, Hiding in Plain Sight, Tools for Malware Analysis

attackers tunneling information, Hiding in Plain Sight

attackers’ use of, Hiding in Plain Sight

server, malware access to, Using Your Malware Analysis Machine

tools for controlling responses, Tools for Malware Analysis

DNS requests, Comparing Registry Snapshots with Regshot, Basic Dynamic Tools in Practice

ApateDNS response to, Comparing Registry Snapshots with Regshot

checking for, Basic Dynamic Tools in Practice

documentation manuals, for x86 architecture, More Information: Intel x86 Architecture Manuals

domain, Indications of Malicious Activity, OPSEC = Operations Security, Getting IP Address and Domain Information

and malicious activity, Indications of Malicious Activity

blacklists, Getting IP Address and Domain Information

getting information, OPSEC = Operations Security

Domain Name System, Hiding in Plain Sight (see DNS (Domain Name System))

DomainTools, Getting IP Address and Domain Information

double-packed malware, Repairing the Import Table Manually

downloaders, Basic Dynamic Analysis, Malware Behavior, Short Answers

malware as, Short Answers

downloading malware, opening URL for, Detailed Analysis, Detailed Analysis

driver objects, Drivers and Kernel Code, Looking at the Kernel-Mode Code, Analyzing Lab10-01.sys in WinDbg

finding, Looking at the Kernel-Mode Code

getting list, Analyzing Lab10-01.sys in WinDbg

structure in Windows, Drivers and Kernel Code

driver signature, 64-bit versions of Windows and, Kernel Issues for Windows Vista, Windows 7, and x64 Versions

DriverEntry function, Drivers and Kernel Code, Viewing Lab10-01.sys in IDA Pro

DriverInit function, Viewing Structure Information, Finding the Driver in Memory with WinDbg

DriverUnload command, Finding the Driver in Memory with WinDbg

!drvobj command, in WinDbg, Looking at the Kernel-Mode Code

dt command, in WinDbg, Looking at the Kernel-Mode Code, Analyzing Lab10-01.sys in WinDbg, Finding the Driver in Memory with WinDbg, Analyzing the Functions of the Major Function Table

du command, in WinDbg, Setting Up Kernel Debugging

dummy names, Enhancing Disassembly, Global vs. Local Variables

changing, Global vs. Local Variables

Dummy service, in INetSim, Using INetSim

dump command, in OllyDbg, The BeingDebugged Flag

dumping executable from memory, Manual Unpacking, Tools for Malware Analysis

OllyDump for, Manual Unpacking

dwo command, in WinDbg, Reading from Memory

DWORD, Handles, Repairing the Import Table Manually

call instruction with target based on, Repairing the Import Table Manually

in Windows API, Handles

dynamic analysis, The Goals of Malware Analysis, Basic Dynamic Analysis, Basic Dynamic Analysis, Basic Dynamic Analysis, Basic Dynamic Analysis, Using a Malware Sandbox, Sandbox Drawbacks, Running Malware, Viewing Processes with Process Explorer, Analyzing Malicious Documents, Comparing Registry Snapshots with Regshot, Monitoring with Netcat, Packet Sniffing with Wireshark, Using INetSim, Lab 3-1, A Crash Course in x86 Disassembly, Taking a Deeper Look, Tools for Malware Analysis, Detailed Analysis

(see also debuggers)

advanced, Basic Dynamic Analysis

basic, The Goals of Malware Analysis

basic tools in practice, Using INetSim

benefits of, Basic Dynamic Analysis

Capture BAT for, Tools for Malware Analysis

combining with static analysis, Taking a Deeper Look

comparing Registry snapshots with Regshot, Analyzing Malicious Documents

faking network, Comparing Registry Snapshots with Regshot

INetSim, Packet Sniffing with Wireshark

labs, Lab 3-1, Detailed Analysis

solutions, Detailed Analysis

packet sniffing with Wireshark, Monitoring with Netcat

Process Explorer for viewing processes, Viewing Processes with Process Explorer

Process Monitor (procmon), Running Malware

running malware, Sandbox Drawbacks

sandboxes, Basic Dynamic Analysis, Using a Malware Sandbox

drawbacks, Using a Malware Sandbox

dynamic link libraries (DLLs), Finding Strings, Exploring Dynamically Linked Functions with Dependency Walker, Sandbox Drawbacks, Sandbox Drawbacks, IDA Pro, The Server and Client Sides of Networking, DLLs, Rebasing, Memory Breakpoints, Trojanized System Binaries, Launchers, DLL Injection, Detours, Analyzing Without Fully Unpacking, Detailed Analysis, Using the Memory Map to Locate DLLs, Detailed Analysis

analyzing in IDA Pro, Detailed Analysis

base address different from preferred, IDA Pro

basic structure, DLLs

Detours to add new to existing binaries, Detours

injection, Launchers, DLL Injection

debugger view, DLL Injection

launching, Sandbox Drawbacks

load-order hijacking, for persistence, Trojanized System Binaries

loading in OllyDbg, Memory Breakpoints

malware as, Sandbox Drawbacks

memory addresses for, Rebasing

memory map to locate, Using the Memory Map to Locate DLLs

packed, Analyzing Without Fully Unpacking

Process Explorer for finding injection, Detailed Analysis

dynamic linking, Static, Runtime, and Dynamic Linking

dynamic unpacking programs, automated, Automated Unpacking

dynamically linked functions, exploring with Dependency Walker, Static, Runtime, and Dynamic Linking

\Device\PhysicalDisk1, Files Accessible via Namespaces

\Device\PhysicalMemory, The Windows Registry